IN THE CLAIMS 



This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1 . (Previously presented) A system comprising: 

a processor; and 

a memory, coupled to the processor, wherein the memory is configured to provide the 
processor with instructions which when executed cause the processor to: 

determine one or more quantities of damages avoided by one or more blocked 
attacks; and 

calculate security consumption during a period of time. 

2. (Currently amended) The system of claim 1, wherein determining one or more quantities of 
damages includes determining whether a blocked attack would have exploited a network 
vulnerability. 

3. (Previously presented) The system of claim 2, wherein determining whether a blocked attack 
would have exploited network vulnerability includes replaying the attack on an internal network. 

4. (Previously presented) The system of claim 1, further comprising a scanner configured to 
scan one or more devices for vulnerabilities. 

5. (Previously presented) The system of claim 4, wherein the scanner is configured to quantify 
the risk of one or more devices. 

6. (Previously presented) The system of claim 4, wherein the scanner is located within a 
customer network. 

7. (Previously presented) The system of clam 1, further comprising an intrusion suppression 
module configured to block attacks. 
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8. (Previously presented) The system of claim 7, wherein the intrusion suppression module is 
configured to maintain a list of attacks sustained and blocked during a period of time. 

9. (Previously presented) The system of claim 7, wherein the intrusion suppression module is 
located outside a customer network. 

10. (Currently amended) A network security method comprising: 

determinin g, using a processor, one or more quantities of damages avoided by one or 
more blocked attacks; and 

calculating security protection consumption during a period of time. 

11. (Previously presented) The method of claim 10, further comprising determining whether a 
blocked attack would have exploited network vulnerability. 

12. (Previously presented) The method of claim 10, further comprising scanning one or more 
devices for vulnerabilities. 

13. (Previously presented) The method of claim 12, further comprising quantifying the risk of 
one or more devices. 

14. (Currently amended) The method claim 10, further comprising blocking one or more attacks. 

15. (Previously presented) The method of claim 14, further comprising maintaining a list of 
attacks sustained and blocked during a period of time. 

16. (Currently amended) A network security apparatus comprising comprised of : 

means for determining one or more quantities of damages avoided by one or more 
blocked attacks; and 

means for calculating security protection consumption during a period of time. 
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17. (Original) The apparatus of claim 16, further comprised of the means for determining 
whether a blocked attack would have exploited network vulnerability. 

18. (Original) The apparatus of claim 16, further comprised of the means for scanning one or 
more devices for vulnerabilities. 

19. (Original) The apparatus of claim 18, further comprised of the means for quantifying the risk 
of one or more devices. 

20. (Original) The apparatus claim 16, further comprised of the means for blocking one or more 
attacks. 

21. (Original) The apparatus of claim 20, further comprised of the means for maintaining a list 
of attacks sustained and blocked during a period of time. 

22. (Currently amended) A computer program product embodied in a non-transitory computer- 
readable storage medium, [[and]] comprising computer executable instructions for: 

determining one or more quantities of damages avoided by one or more blocked attacks; 

and 

calculating security protection consumption during a period of time. 

23. (Currently amended) The computer program product of claim [[21]] 22, further comprising 
computer instructions for determining whether a blocked attack would have exploited network 
vulnerability. 

24. (Currently amended) The computer program product of claim [[21]] 22, further comprising 
computer instructions for scanning one or more devices for vulnerabilities. 

25. (Currently amended) The computer program product of claim [[21]] 22, further comprising 
computer instructions for quantifying risk of one or more devices. 

26-28. (Cancelled) 
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29. (Previously presented) The system of claim 1 wherein the processor is configured to 
calculate security consumption including by determining a monetary value associated with the 
damages avoided. 

30. (Previously presented) The system of claim 1 wherein the processor is configured to 
determine one or more quantities at least in part by determining a first portion of damages 
avoided by a customer and by determining a second portion of damages avoided by a party other 
than the customer on behalf of the customer. 

3 1 . (Previously presented) The system of claim 1 wherein the processor is configured to 
determine one or more quantities at least in part by determining a count of the one or more 
blocked attacks. 
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